[ 27.745599][ T48] device bridge_slave_0 left promiscuous mode [ 27.751764][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.759303][ T48] device veth1_macvtap left promiscuous mode [ 27.765460][ T48] device veth0_vlan left promiscuous mode [ 29.171560][ T48] device bridge_slave_1 left promiscuous mode [ 29.177681][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.185301][ T48] device bridge_slave_0 left promiscuous mode [ 29.191574][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.199213][ T48] device veth1_macvtap left promiscuous mode [ 29.205289][ T48] device veth0_vlan left promiscuous mode Warning: Permanently added '10.128.1.253' (ED25519) to the list of known hosts. 2026/01/04 00:59:36 parsed 1 programs Setting up swapspace version 1, size = 127995904 bytes [ 46.441532][ T24] kauditd_printk_skb: 31 callbacks suppressed [ 46.441543][ T24] audit: type=1400 audit(1767488376.770:105): avc: denied { unlink } for pid=410 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 46.491272][ T24] audit: type=1400 audit(1767488376.820:106): avc: denied { write } for pid=413 comm="mkswap" path="pipe:[15169]" dev="pipefs" ino=15169 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 46.514269][ T410] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 47.170058][ T24] audit: type=1400 audit(1767488377.490:107): avc: denied { create } for pid=432 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 47.342949][ T24] audit: type=1401 audit(1767488377.670:108): op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768" [ 47.537079][ T461] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.544174][ T461] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.551819][ T461] device bridge_slave_0 entered promiscuous mode [ 47.558605][ T461] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.565751][ T461] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.573196][ T461] device bridge_slave_1 entered promiscuous mode [ 47.603687][ T461] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.610843][ T461] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.618275][ T461] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.625320][ T461] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.641306][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 47.648957][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.656348][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.665197][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 47.674328][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.681384][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 47.690200][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 47.698786][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.705850][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 47.717409][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 47.726602][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 47.739240][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 47.749904][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 47.758372][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 47.766155][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 47.774953][ T461] device veth0_vlan entered promiscuous mode [ 47.784722][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 47.793696][ T461] device veth1_macvtap entered promiscuous mode [ 47.802583][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 47.812510][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 2026/01/04 00:59:38 executed programs: 0 [ 48.094679][ T475] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.101958][ T475] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.109200][ T475] device bridge_slave_0 entered promiscuous mode [ 48.116082][ T475] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.123258][ T475] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.130645][ T475] device bridge_slave_1 entered promiscuous mode [ 48.168620][ T475] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.175872][ T475] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.183566][ T475] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.190714][ T475] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.213558][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.221740][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.229017][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.242844][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.251240][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.258445][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.267042][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.275249][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.282297][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.295903][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 48.305165][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 48.317688][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 48.330579][ T475] device veth0_vlan entered promiscuous mode [ 48.342596][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 48.350699][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 48.358280][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 48.365960][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 48.375110][ T475] device veth1_macvtap entered promiscuous mode [ 48.393165][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 48.403218][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 48.419767][ T24] audit: type=1400 audit(1767488378.740:109): avc: denied { create } for pid=496 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 48.439810][ T24] audit: type=1400 audit(1767488378.740:110): avc: denied { write } for pid=496 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 48.460536][ T24] audit: type=1400 audit(1767488378.740:111): avc: denied { nlmsg_write } for pid=496 comm="syz.2.17" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 48.750888][ C0] ================================================================== [ 48.759243][ C0] BUG: KASAN: stack-out-of-bounds in __xfrm_dst_hash+0x399/0x480 [ 48.767179][ C0] Read of size 4 at addr ffffc90000007b18 by task swapper/0/0 [ 48.774675][ C0] [ 48.777004][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 [ 48.784473][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 48.794516][ C0] Call Trace: [ 48.797919][ C0] [ 48.800853][ C0] __dump_stack+0x21/0x24 [ 48.805163][ C0] dump_stack_lvl+0x169/0x1d8 [ 48.809922][ C0] ? show_regs_print_info+0x18/0x18 [ 48.815100][ C0] ? thaw_kernel_threads+0x220/0x220 [ 48.820517][ C0] ? __do_softirq+0x255/0x563 [ 48.825391][ C0] print_address_description+0x7f/0x2c0 [ 48.830984][ C0] ? __xfrm_dst_hash+0x399/0x480 [ 48.835998][ C0] kasan_report+0xe2/0x130 [ 48.840560][ C0] ? __xfrm_dst_hash+0x399/0x480 [ 48.845602][ C0] __asan_report_load4_noabort+0x14/0x20 [ 48.851219][ C0] __xfrm_dst_hash+0x399/0x480 [ 48.856066][ C0] xfrm_state_find+0x27e/0x2880 [ 48.860915][ C0] ? unwind_next_frame+0x3d5/0x700 [ 48.866104][ C0] ? xfrm_sad_getinfo+0x170/0x170 [ 48.871112][ C0] ? stack_trace_save+0x98/0xe0 [ 48.876201][ C0] ? stack_trace_snprint+0xf0/0xf0 [ 48.881396][ C0] xfrm_resolve_and_create_bundle+0x626/0x28d0 [ 48.887646][ C0] ? xfrm_sk_policy_lookup+0x470/0x470 [ 48.893110][ C0] ? xfrm_selector_match+0xb7e/0x1030 [ 48.898505][ C0] ? __xfrm_policy_check+0x2920/0x2920 [ 48.903973][ C0] ? __kasan_check_write+0x14/0x20 [ 48.909165][ C0] xfrm_lookup_with_ifid+0x6e5/0x1980 [ 48.914524][ C0] ? percpu_counter_add_batch+0x13c/0x160 [ 48.920244][ C0] ? rt_set_nexthop+0x5ce/0x790 [ 48.925096][ C0] ? __xfrm_sk_clone_policy+0x680/0x680 [ 48.930712][ C0] ? ip_route_output_key_hash_rcu+0x15af/0x20e0 [ 48.936935][ C0] xfrm_lookup_route+0x3c/0x170 [ 48.941774][ C0] ip_route_output_flow+0x1d2/0x2d0 [ 48.947072][ C0] ? igmpv3_newpack+0x156/0xc40 [ 48.952083][ C0] ? ipv4_sk_update_pmtu+0x1320/0x1320 [ 48.957730][ C0] ? make_kuid+0x1ad/0x640 [ 48.962132][ C0] ? __put_user_ns+0x60/0x60 [ 48.966715][ C0] ? __kasan_check_write+0x14/0x20 [ 48.971996][ C0] ? __alloc_skb+0x38b/0x520 [ 48.976576][ C0] igmpv3_newpack+0x264/0xc40 [ 48.981244][ C0] ? igmpv3_sendpack+0x190/0x190 [ 48.986287][ C0] ? enqueue_task+0x176/0x1000 [ 48.991143][ C0] add_grhead+0x75/0x2e0 [ 48.995546][ C0] add_grec+0x116b/0x1410 [ 48.999948][ C0] ? __kasan_check_write+0x14/0x20 [ 49.005046][ C0] igmp_ifc_timer_expire+0x89e/0xf80 [ 49.010317][ C0] ? __kasan_check_write+0x14/0x20 [ 49.015512][ C0] ? _raw_spin_lock_irq+0x8f/0xe0 [ 49.020536][ C0] ? _raw_spin_lock_irqsave+0x110/0x110 [ 49.026072][ C0] ? igmp_gq_timer_expire+0xe0/0xe0 [ 49.031260][ C0] call_timer_fn+0x38/0x290 [ 49.035760][ C0] ? igmp_gq_timer_expire+0xe0/0xe0 [ 49.041155][ C0] __run_timers+0x639/0x9a0 [ 49.045690][ C0] ? calc_index+0x200/0x200 [ 49.050203][ C0] ? sched_clock_cpu+0x1b/0x3d0 [ 49.055061][ C0] run_timer_softirq+0x6a/0xf0 [ 49.059903][ C0] __do_softirq+0x255/0x563 [ 49.064422][ C0] asm_call_irq_on_stack+0xf/0x20 [ 49.069443][ C0] [ 49.072400][ C0] do_softirq_own_stack+0x60/0x80 [ 49.077419][ C0] __irq_exit_rcu+0x128/0x150 [ 49.082091][ C0] irq_exit_rcu+0x9/0x10 [ 49.086325][ C0] sysvec_apic_timer_interrupt+0xbf/0xe0 [ 49.091952][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 49.098118][ C0] RIP: 0010:default_idle+0x12/0x20 [ 49.103237][ C0] Code: 48 8b 7c 24 10 e8 be 29 00 00 e9 71 ff ff ff e8 a4 fe fa ff 00 00 cc cc 55 48 89 e5 0f 1f 44 00 00 0f 00 2d e0 b8 4c 00 fb f4 <5d> c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 55 48 89 e5 41 57 41 56 [ 49.123570][ C0] RSP: 0018:ffffffff86207d58 EFLAGS: 00000256 [ 49.129639][ C0] RAX: ffff8881f7000000 RBX: ffffffff8621c100 RCX: 0000000000008f5e [ 49.137712][ C0] RDX: 0000000000000001 RSI: ffffffff85202d40 RDI: ffffffff85202d00 [ 49.145703][ C0] RBP: ffffffff86207d58 R08: dffffc0000000000 R09: ffffed103ee0ae7b [ 49.153944][ C0] R10: ffffed103ee0ae7b R11: 1ffff1103ee0ae7a R12: 0000000000000000 [ 49.161931][ C0] R13: 1ffffffff0c43820 R14: 0000000000000000 R15: dffffc0000000000 [ 49.170001][ C0] arch_cpu_idle+0xa/0x10 [ 49.174347][ C0] default_idle_call+0x71/0x1d0 [ 49.179293][ C0] do_idle+0x1df/0x530 [ 49.183416][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 49.188708][ C0] ? radix_tree_lookup+0x183/0x1d0 [ 49.193811][ C0] ? debug_smp_processor_id+0x17/0x20 [ 49.199170][ C0] cpu_startup_entry+0x18/0x20 [ 49.203951][ C0] rest_init+0xe8/0xf0 [ 49.208015][ C0] ? time_init+0x38/0x38 [ 49.212295][ C0] arch_call_rest_init+0xe/0x10 [ 49.217167][ C0] start_kernel+0x42e/0x49c [ 49.221671][ C0] x86_64_start_reservations+0x2a/0x2c [ 49.227216][ C0] x86_64_start_kernel+0x60/0x63 [ 49.232147][ C0] secondary_startup_64_no_verify+0xad/0xbb [ 49.238024][ C0] [ 49.240367][ C0] [ 49.242700][ C0] Memory state around the buggy address: [ 49.248427][ C0] ffffc90000007a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 49.256637][ C0] ffffc90000007a80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 [ 49.264730][ C0] >ffffc90000007b00: 00 00 00 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 [ 49.272871][ C0] ^ [ 49.278083][ C0] ffffc90000007b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 49.286234][ C0] ffffc90000007c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 49.294283][ C0] ================================================================== [ 49.302484][ C0] Disabling lock debugging due to kernel taint [ 49.526597][ T48] device bridge_slave_1 left promiscuous mode [ 49.532938][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.540329][ T48] device bridge_slave_0 left promiscuous mode [ 49.546776][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.554856][ T48] device veth1_macvtap left promiscuous mode [ 49.561427][ T48] device veth0_vlan left promiscuous mode 2026/01/04 00:59:43 executed programs: 246 2026/01/04 00:59:48 executed programs: 546